Daily Snap Monitor #139
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Daily Snap Monitor | |
| on: | |
| schedule: | |
| - cron: "17 3 * * *" | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| jobs: | |
| monitor: | |
| runs-on: ubuntu-latest | |
| env: | |
| PACKAGE_NAME: cvecli | |
| CVE_ID: cve-2025-55182 | |
| steps: | |
| - name: Initialize state | |
| shell: bash | |
| run: | | |
| echo "CVECLI_VERSION=unknown" >> "$GITHUB_ENV" | |
| echo "TEST_STATUS=failed" >> "$GITHUB_ENV" | |
| echo "CVE_OUTPUT_RETURNED=no" >> "$GITHUB_ENV" | |
| echo "CVE_COMMAND=cvecli --id ${CVE_ID}" >> "$GITHUB_ENV" | |
| - name: Setup snapd | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| sudo apt-get update | |
| sudo apt-get install -y snapd | |
| sudo systemctl enable --now snapd.socket || true | |
| sudo systemctl restart snapd || true | |
| sudo ln -sf /var/lib/snapd/snap /snap || true | |
| echo "/snap/bin" >> "$GITHUB_PATH" | |
| snap version | |
| - name: Install or update cvecli | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| if snap list "${PACKAGE_NAME}" >/dev/null 2>&1; then | |
| sudo snap refresh "${PACKAGE_NAME}" --channel=stable || \ | |
| sudo snap refresh "${PACKAGE_NAME}" --channel=stable | |
| else | |
| sudo snap install "${PACKAGE_NAME}" --channel=stable || \ | |
| sudo snap install "${PACKAGE_NAME}" --channel=stable | |
| fi | |
| command -v cvecli | |
| - name: Get version | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| version="$(cvecli --version 2>/dev/null || true)" | |
| version="$(echo "$version" | head -n 1 | tr -d '\r')" | |
| if [ -z "$version" ]; then | |
| version="unknown" | |
| fi | |
| echo "CVECLI_VERSION=${version}" >> "$GITHUB_ENV" | |
| - name: Run CVE functional test | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| set +e | |
| output="$(cvecli --id "${CVE_ID}" 2>&1)" | |
| rc=$? | |
| set -e | |
| printf '%s\n' "$output" > cve_output.txt | |
| stripped="$(printf '%s' "$output" | tr -d '\r' | tr -d '[:space:]')" | |
| lowered="$(printf '%s' "$output" | tr -d '\r' | tr '[:upper:]' '[:lower:]')" | |
| if [ $rc -ne 0 ]; then | |
| echo "TEST_STATUS=failed" >> "$GITHUB_ENV" | |
| echo "CVE_OUTPUT_RETURNED=no" >> "$GITHUB_ENV" | |
| elif [ -z "$stripped" ]; then | |
| echo "TEST_STATUS=failed" >> "$GITHUB_ENV" | |
| echo "CVE_OUTPUT_RETURNED=no" >> "$GITHUB_ENV" | |
| elif printf '%s' "$lowered" | grep -q "^[[:space:]]*error:\|failed to fetch cve\|network error\|invalid json"; then | |
| echo "TEST_STATUS=failed" >> "$GITHUB_ENV" | |
| echo "CVE_OUTPUT_RETURNED=yes" >> "$GITHUB_ENV" | |
| else | |
| echo "TEST_STATUS=success" >> "$GITHUB_ENV" | |
| echo "CVE_OUTPUT_RETURNED=yes" >> "$GITHUB_ENV" | |
| fi | |
| - name: Build Telegram message | |
| if: always() | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| if [ "${TEST_STATUS}" = "success" ]; then | |
| STATUS="✅ Healthy" | |
| else | |
| STATUS="❌ Failed" | |
| fi | |
| MSG="$(printf '%s\n' \ | |
| "Monitor: Snap" \ | |
| "Status: ${STATUS}" \ | |
| "Package: ${PACKAGE_NAME}" \ | |
| "Version: ${CVECLI_VERSION}" \ | |
| "CVE command: ${CVE_COMMAND}" \ | |
| "Output returned: ${CVE_OUTPUT_RETURNED}" \ | |
| "Repo: ${GITHUB_REPOSITORY}" \ | |
| "Run: #${GITHUB_RUN_NUMBER}" \ | |
| "SHA: ${GITHUB_SHA}" \ | |
| "Branch: ${GITHUB_REF_NAME}")" | |
| echo "MESSAGE<<EOF" >> "$GITHUB_ENV" | |
| echo "$MSG" >> "$GITHUB_ENV" | |
| echo "EOF" >> "$GITHUB_ENV" | |
| - name: Send Telegram notification | |
| if: always() | |
| shell: bash | |
| env: | |
| TELEGRAM_TOKEN: ${{ secrets.TELEGRAM_TOKEN }} | |
| TELEGRAM_CHAT_ID: ${{ secrets.TELEGRAM_CHAT_ID }} | |
| run: | | |
| set -euo pipefail | |
| curl -fsS --retry 3 --retry-all-errors \ | |
| -X POST "https://api.telegram.org/bot${TELEGRAM_TOKEN}/sendMessage" \ | |
| -d "chat_id=${TELEGRAM_CHAT_ID}" \ | |
| --data-urlencode "text=${MESSAGE}" | |
| - name: Fail workflow if unhealthy | |
| if: always() | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| if [ "${TEST_STATUS}" != "success" ]; then | |
| exit 1 | |
| fi |